6.6. ERMUSR 05-16-2006 - Laserfiche WebLink

Home Browse Search

The Plan(s) will backup ePHI, and critical applications according to existing Plan Sponsor information system backup procedures and policies. Disaster Recovery, Emergency Mode Operation Plan, Testing and Revision Procedures [§164.308(a)(1)(ii)(B), §164.308(a)(1)(ii)(C), §164.308(a)(1)(ii)(D), §164.312(a)(2)(ii)] It has been determined that a formal disaster recovery operation plan applicable only to ePHI is not reasonable or necessary. The Plan(s) will operate in the event of an emergency based on existing emergency operation procedures of the plan sponsor, including granting access to facilities during an emergency. The Plan's Security Official will periodically review The Plan's contingency procedures to determine if changes or testing of the procedures is appropriate. 7. Business Associate Contracts The Plan(s) will allow a Business Associate of The Plan(s) to create, receive, maintain, or transmit ePHI on behalf of The Plan(s), only once The Plan(s) obtains written assurance through the use of business associate agreements that the Business Associate will appropriately safeguard The Plan's ePHI as required by § 164.314(a). 8. Facility Access Controls The Plan's ePHI is not located in facilities or locations that make it reasonable to implement facility security, access control or maintenance of security records procedures applicable ePHI locations only. Physical access to facilities where ePHI is maintained will be subject to existing Plan Sponsor physical security procedures and policies when applicable. 9. Workstation Use and Security and Access and Audit Controls [§164.310(b), §164.310(c), §164.312(a)(2)(i), §164.312(a)(2)(iii), ~164.312(a)(2)(iv)] The Plan(s) implements the following procedures to control access to ePHI and manage access to workstations that can be used to access ePHI. Employees will be assigned unique user names and passwords for systems used to access ePHI. These unique user IDs maybe assigned according to existing Plan Sponsor system access policies and procedures. The following workstation procedures will be implemented to mirturuze the potential risk of inappropriate use of ePHI to the extent possible and reasonable. a. When accessing ePHI on a workstation, employees will reduce visible windows or close programs whenever they are not physically present at the workstation or when individuals not authorized to access the ePHI can view the workstation. b. Workstation screensavers will be set to engage at a reasonably short timeframe. c. VC~orkstations located in areas where viewing by unauthorized individuak is likely will be equipped with monitor screens that limit the visibility of data to anyone other than the workstation user. d. Users with portable workstations such as laptops or PDAs are not allowed to store ePHI on workstation drives. All ePHI should be stored on Plan Sponsor servers subject to security